Setting up a custom Netflow alert

JJay04

I would like to setup an alerts for certain subnet if BW from that subnet exceeds a certain mbps or gbps. Is this possible?

Thanks

stibi

Hi @JJay04 ,

This should be doable, but the alert will always be limited by node. I assume that those subnets will be passing by single node, so it should not be an issue, but I might be wrong. Anyway, here are the steps:

1. Navigate to NTA Settings -> IP Groups Management.
2. Create an IP Group with the subnet that we will use for the alert.
3. Navigate to the alert management page.
4. Search for alert "Endpoint traffic is over 5 GB in last hour" as we will use it as a template.
5. Duplicate this alert
6. Since the triggered alert will show only the node for which it was triggered, I recommend naming the alert in a way that you will immediately know for which subnet it was triggered.
7. Click on the next button, which will navigate you to the Trigger Condition section
8. Paste the following query into the bottom part of the query (the top part is not editable):
   1.             INNER JOIN
                  (
                  SELECT Flows.IPGroup.IPAddressGroupID, NodeID
                  FROM Orion.Netflow.FlowsByIP AS Flows
                  WHERE
                  (TimeStamp >= AddMinute(-61, DateTrunc('minute', GetUtcDate())) AND TimeStamp < AddMinute(-1, DateTrunc('minute', GetUtcDate()))) AND Flows.IPGroup.Name = 'solarwinds'
                  GROUP BY Flows.IPGroup.IPAddressGroupID, NodeID
                  HAVING ((SUM(Bytes)) / (1024 * 1024 * 1024)) > 1
                  ) AS Flows
                  ON Flows.NodeID = Nodes.NodeID
9. In the WHERE clause you must change Flows.IPGroup.Name = 'solarwinds' with the name of your IP Address Group that you created in step 2.
10. Section HAVING ((SUM(Bytes)) / (1024 * 1024 * 1024)) > 1 is the main trigger condition. Meaning that the alert will trigger if that IP Address Group exceeds 1 GB of data.
11. The time condition is set to the past 1 hour. Feel free to adjust it based on your needs.
12. Finish the alert creation. There are no additional steps specific to this alert.
13. Alert is disabled by default, so you will need to enable it.

Hope this will work. Let me know if you will want some adjustments.